Authentication system, authentication terminal, authentication server, and authentication program

Abstract

To provide a multi-level authentication system that is improved in safety for SMS authentication.SOLUTION: An authentication server 10 comprises: a message transmission unit 111 for transmitting a message for authentication to an authentication terminal 20 by a telephone number tied to a user ID in accordance with access in association with the user ID; an approval page transmission unit 112 for transmitting an approval page to the authentication terminal 20 in accordance with a request of the approval page that is shown by URL described in the message for authentication; a request reception unit 113 for receiving application information for identifying approval information and an application X from the authentication terminal 20 in accordance with an approval operation for the application X that is started based on a description of the approval page; and an application verification unit 114 for authenticating access, when the application information received by the request reception unit 113 is collated with information tied to the telephone number and registered in advance and then they are the same.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a multi-stage authentication system using SMS. [Background technology]

[0002] Conventionally, in order to improve security during user authentication, two-step authentication using SMS sent to mobile terminals has been widely adopted (for example, see Patent Document 1). However, in recent years, damage caused by attacks using malware that eavesdrop on SMS has been increasing. To counter these attacks, two-step authentication using means other than SMS, such as authentication using an Authenticator app or FIDO (registered trademark), has been proposed. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2007-058469 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, conventional authentication methods such as authentication by an Authenticator app or authentication by FIDO cannot be used as a primary authentication method because login is not possible when the device is lost, and a separate authentication method must be provided for when the device is lost. In addition, SMS has advantages in terms of feasibility on various devices, convenience, cost, etc., making it difficult to switch to other authentication methods.

[0005] An object of the present invention is to provide a multi-stage authentication system that improves the security of SMS authentication. [Means for solving the problem]

[0006] an authentication system according to the present invention includes an authentication terminal and an authentication server, and the authentication server authenticates access in response to an access involving a user ID. The authentication terminal includes a message receiving unit that receives and presents an authentication message sent from the authentication server, an approval page receiving unit that requests an approval page indicated by a URL described in the authentication message from the authentication server and receives and presents the approval page, an application launch unit that launches a specified application based on the description of the approval page, and an authentication request unit that transmits app information for identifying the specified application to the authentication server together with approval information in response to an approval operation for the specified application. The authentication server includes a message sending unit that transmits the authentication message to the authentication terminal by a telephone number associated with the user ID in response to the access, an approval page sending unit that transmits the approval page to the authentication terminal in response to the request, a request receiving unit that receives the approval information and the app information from the authentication terminal, and an app verification unit that compares the app information received by the request receiving unit with information previously registered in association with the telephone number and authenticates the access if they are identical.

[0007] When checking the application information, if there is no information associated with the telephone number, the application verification unit may authenticate the access and register the received application information.

[0008] The authentication terminal of the present invention includes a message receiving unit that receives and presents an authentication message sent from an authentication server by a telephone number linked to a user ID in response to access involving a user ID; an approval page receiving unit that requests an approval page indicated by a URL described in the authentication message from the authentication server, and receives and presents the approval page; an application launch unit that launches a specified application based on the contents of the approval page; and an authentication request unit that sends app information for identifying the specified application together with approval information to the authentication server in response to an approval operation for the specified application, thereby comparing the app information with information that is previously registered in the authentication server in association with the telephone number, and authenticating the access if they are identical.

[0009] The authentication server of the present invention includes a message sending unit that sends an authentication message to an authentication terminal using a telephone number linked to a user ID in response to an access involving a user ID; an approval page sending unit that sends an approval page to the authentication terminal in response to a request for an approval page indicated by a URL described in the authentication message; a request receiving unit that receives approval information and app information for identifying a specified application from the authentication terminal in response to an approval operation for a specified application launched based on the contents of the approval page; and an app verification unit that compares the app information received by the request receiving unit with information previously registered in association with the telephone number, and authenticates the access if the information is identical.

[0010] The authentication program according to the present invention causes a computer to function as the authentication server. Effect of the Invention

[0011] According to the present invention, it is possible to improve the security of SMS authentication in a multi-stage authentication system. [Brief description of the drawings]

[0012] [Figure 1]FIG. 1 is a diagram illustrating a functional configuration of an authentication system according to an embodiment. [Diagram 2] FIG. 11 is a sequence diagram illustrating an authentication procedure in the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] An example of an embodiment of the present invention will now be described. In the authentication system of this embodiment, when two-step authentication is performed by sending the URL of an approval page to an authentication terminal using SMS, the user performs an approval operation on the screen of a specified application launched from the approval page instead of on this approval page. The application information for identifying this predetermined application is registered in advance in the authentication server, and it is verified that it matches the application information sent in response to the approval operation.

[0014] FIG. 1 is a diagram showing the functional configuration of an authentication system 1 according to the present embodiment. The authentication system 1 is configured to carry out SMS authentication and additional authentication using an authentication terminal 20 when a login terminal 30 accesses an authentication server 10. Information including the telephone number of the authentication terminal 20 held by a user is registered in advance in the authentication server 10 in association with a user ID. The authentication terminal 20 may also function as the login terminal 30 .

[0015] The authentication terminal 20 is an information processing device capable of receiving a message based on a telephone number (hereinafter, referred to as SMS) for two-step authentication, and corresponds to a mobile terminal such as a smartphone. In the authentication terminal 20, an application for accessing the authentication server 10 (hereinafter referred to as a browser application) and an application for receiving SMS (hereinafter referred to as an SMS application) run. Furthermore, for additional authentication, a specific application (application X) is pre-installed in the authentication terminal 20. This application X has unique application information, and is registered in the authentication server 10 in association with the telephone number of the authentication terminal 20.

[0016] The control unit 11 of the authentication server 10 executes software (authentication program) stored in the storage unit 12 to function as a message sending unit 111, an approval page sending unit 112, a request receiving unit 113, and an application verifying unit 114.

[0017] In response to an access including a user ID from the login terminal 30, the message sending unit 111 sends an SMS for authentication, including a URL, to the authentication terminal 20 using the telephone number associated with the user ID.

[0018] The approval page transmitting unit 112 transmits a corresponding approval page in response to a request from the authentication terminal 20 (browser application) based on the URL described in the authentication SMS.

[0019] The request receiving unit 113 receives, in response to a user's approval operation for the launched application X based on the description on the approval page, approval information and application information for identifying the installed application X from the authentication terminal 20.

[0020] The application verification unit 114 compares the application information received by the request receiving unit 113 with information that has been registered in advance in association with the telephone number of the authentication terminal 20, and if the information is identical, authenticates the access from the login terminal 30 and completes the login.

[0021] Here, the application information may be separately registered in the authentication server when application X is installed, but if there is no information linked to the telephone number of the authentication terminal 20 when verifying the application information, the application verification unit 114 may authenticate the access and register the received application information.

[0022] The control unit 21 of the authentication terminal 20 executes software (browser application, SMS application, application X) stored in the memory unit 22, and thereby functions as a message receiving unit 211, an approval page receiving unit 212, an application launching unit 213, and an authentication requesting unit 214.

[0023] The message receiving unit 211 receives an SMS for authentication sent from the authentication server 10 by an SMS application, and presents the SMS to the user. This SMS contains a URL as authentication information, and this URL will launch the browser app.

[0024] The approval page receiving unit 212 requests the authentication server 10 via a browser application for an approval page indicated by the URL described in the authentication SMS, and receives and presents the returned approval page.

[0025] The application launch unit 213 launches a predetermined application (application X) based on the description on the approval page using the browser application.

[0026] In response to a user's approval operation for application X, the authentication request unit 214 transmits to the authentication server 10 application information for identifying the application X together with approval information.

[0027] FIG. 2 is a sequence diagram illustrating an authentication procedure in this embodiment. In this example, login to the authentication server 10 is performed from a login terminal 30 different from the authentication terminal 20 .

[0028] In step S1, the user performs an operation to start logging in to the authentication server 10 on a browser running on the login terminal 30. In step S2, the login terminal 30 (browser) accesses the authentication server 10 and requests a login page. In step S3, the authentication server 10 returns the login page to the login terminal 30.

[0029] In step S4, the user enters an ID (and password) on the displayed login page. In step S5, the login terminal 30 (browser) transmits the input ID (and password) to the authentication server 10. In step S6, the authentication server 10 returns to the login terminal 30 a start page for the two-step authentication.

[0030] In step S7, the authentication server 10 extracts the telephone number associated with the user's ID from the user information database stored in the memory unit 12, and sends an SMS including a URL for two-step authentication to the authentication terminal 20 having this telephone number.

[0031] In step S8, the user selects (tap) the URL described in the transmitted SMS, and requests that the page of this URL be opened in the browser of the authentication terminal 20. Note that the URL may be automatically read by the authentication terminal 20 and input to the browser application.

[0032] In step S9, the authentication terminal 20 (browser application) requests the authentication server 10 for the approval page at the specified URL. In step S10, the authentication server 10 returns an approval page to the authentication terminal 20.

[0033] In step S11, the authentication terminal 20 (browser application) launches the installed application X based on the description on the approval page. In step S12, the user performs an approval operation on the screen of application X displayed on the browser of the authentication terminal 20 (tap a button). In step S13, the authentication terminal 20 (application X) transmits to the authentication server 10 approval information indicating that an approval operation has been performed by the user, and application information unique to the application X.

[0034] In step S14, the authentication server 10 confirms that the application information received in step S13 is the same as the application information associated with the telephone number that is the destination of the SMS transmission in step S7. At this time, if the application information associated with the telephone number has not been registered, that is, if this is the first login, the authentication server 10 registers the received application information for future verification.

[0035] In step S15, the user refreshes the two-step authentication start page (by tapping a button) or waits for an automatic refresh, which causes the login terminal 30 (browser) to confirm the authentication status with the authentication server 10. In step S16, the authentication server 10 transmits a page for after the login is completed and the authentication information to the login terminal 30, thereby completing the login.

[0036] Here, if application X is not installed in authentication terminal 20, the sequence of additional authentication (within the dashed line frame) may be changed to a conventional sequence. That is, if the launch of application X from the approval page fails in step S11, the user performs an approval operation on this approval page, and the authentication terminal 20 (browser application) transmits the approval information to the authentication server 10. In this case, the approval server completes the login based on the approval information without verifying the application information.

[0037] According to this embodiment, when the authentication system 1 performs two-step authentication by transmitting a URL by SMS, the authentication terminal 20 launches application X from an approval page corresponding to the URL. When the user performs an approval operation on the approval screen of application X, the authentication terminal 20 transmits application information unique to application X to the authentication server 10, and the authentication server 10 performs additional authentication by correlating the received application information with information registered in association with the phone number used to transmit the SMS. Therefore, the authentication system 1 can improve the security of SMS authentication in a multi-stage authentication system by verifying that the authentication operation is performed by application X installed on the same terminal.

[0038] Furthermore, if application X is not installed in the authentication terminal 20, application X will not be started and the approval page will continue to be displayed, so that the conventional authentication sequence can be used. Therefore, the authentication system 1 can complete the authentication sequence regardless of whether or not the application X can be used, and can improve security when the application X is used.

[0039] Furthermore, when checking the application information, if there is no information linked to the telephone number, the authentication system 1 authenticates the access and registers the received application information. Therefore, the authentication system 1 can register application information without the user being aware of it during two-step authentication, thereby enhancing security during subsequent logins.

[0040] In addition, the above-mentioned embodiment can, for example, realize SMS authentication that is resistant to malware attacks and reduce the damage caused by unauthorized access, which makes it possible to contribute to Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations, which is to "Develop resilient infrastructure, promote sustainable industrialization and foster innovation."

[0041] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0042] The authentication method by the authentication system 1 is realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0043] 1 Authentication System 10 Authentication Server 11 Control section 12 Storage section 20 Authentication terminal 21 Control section 22 Memory section 30 Login terminal 111 Message sending unit 112 Approval page sending section 113 Request Receiving Unit 114 Application Verification Department 211 Message Receiving Unit 212 Approval page receiving unit 213 App launch section 214 Authentication Request Section

Claims

1. An authentication system comprising an authentication terminal and an authentication server, the authentication server authenticating an access accompanied by a user ID, The authentication terminal includes: a message receiving unit that receives and presents an authentication message transmitted from the authentication server; an approval page receiving unit that requests an approval page indicated by a URL described in the authentication message from the authentication server, and receives and presents the approval page; an application launch unit that launches a predetermined application based on the description on the approval page; an authentication request unit that transmits, in response to an approval operation for the predetermined application, together with approval information, application information specific to the predetermined application for identifying the predetermined application to the authentication server; The authentication server, a message sending unit that sends the authentication message to the authentication terminal by a telephone number associated with the user ID in response to the access; an approval page sending unit that sends the approval page to the authentication terminal in response to a request; a request receiving unit that receives the approval information and the application information from the authentication terminal; an application verification unit that compares the application information received by the request receiving unit with information that is previously associated with the telephone number and registered, and authenticates the access if the information is identical.

2. The authentication system according to claim 1 , wherein when checking the application information, if there is no information linked to the telephone number, the application verification unit authenticates the access and registers the received application information.

3. a message receiving unit that receives and presents an authentication message transmitted from an authentication server by a telephone number associated with the user ID in response to an access involving the user ID; an approval page receiving unit that requests an approval page indicated by a URL described in the authentication message from the authentication server, and receives and presents the approval page; an application launch unit that launches a predetermined application based on the description on the approval page; an authentication terminal comprising: an authentication request unit that, in response to an approval operation for the specified application, sends to the authentication server, together with approval information, app information specific to the specified application for identifying the specified application, thereby comparing the app information with information that is previously registered in the authentication server in association with the telephone number, and authenticates the access if they are identical.

4. a message sending unit that sends an authentication message to an authentication terminal by a telephone number associated with the user ID in response to an access that includes the user ID; an approval page sending unit that sends the approval page to the authentication terminal in response to a request for the approval page indicated by a URL written in the authentication message; a request receiving unit that receives, in response to an approval operation for a specific application that is started based on a description on the approval page, approval information and app information specific to the specific application from the authentication terminal for identifying the specific application; an application verification unit that compares the application information received by the request receiving unit with information that is previously associated with the telephone number and registered, and authenticates the access if the information is identical.

5. An authentication program for causing a computer to function as the authentication server according to claim 4.

Images